# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=869 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 870 --- ## [JDBC last run is updated, but logstash always start from the beggining and duplicate documents](https://discuss.elastic.co/t/jdbc-last-run-is-updated-but-logstash-always-start-from-the-beggining-and-duplicate-documents/280091)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 3:11pm UTC](https://discuss.elastic.co/t/jdbc-last-run-is-updated-but-logstash-always-start-from-the-beggining-and-duplicate-documents/280091 "2021-07-30T15:11:53Z")
Hi, I have a pipeline with JDBC input with schedule of 5 min, I ran logstash as a service sudo systemctl start logstash and the JDBC last run is updated, but when logstash start the last run is not used an duplicate do… --- ## [Extract selected properties from a nested JSON with logstash?](https://discuss.elastic.co/t/extract-selected-properties-from-a-nested-json-with-logstash/280090)
**Author:** [@Samurai1](https://discuss.elastic.co/u/Samurai1)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 2:53pm UTC](https://discuss.elastic.co/t/extract-selected-properties-from-a-nested-json-with-logstash/280090 "2021-07-30T14:53:53Z")
{ "billToLocation": { "prop1": "iwant", "prop2": { "prop2prop1": "iwant", "prop2prop2": { }, "prop2prop3:"iDontWant }, … --- ## [Match any character regular expression does not match as expected](https://discuss.elastic.co/t/match-any-character-regular-expression-does-not-match-as-expected/278918)
**Author:** [@alexleen](https://discuss.elastic.co/u/alexleen)\ **Replies:** 6\ **Last updated:** [July 30, 2021, 2:31pm UTC](https://discuss.elastic.co/t/match-any-character-regular-expression-does-not-match-as-expected/278918 "2021-07-30T14:31:45Z")
POST /search\_test/\_doc { "text":"Jack and Jill went up the hill." } GET /search\_test/\_search?q=j%2A GET /search\_test/\_search?q=j... I would expect those two queries to return the same document since both of those regu… --- ## [ECE Setup - Failed to detect that a master was elected](https://discuss.elastic.co/t/ece-setup-failed-to-detect-that-a-master-was-elected/280041)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 2:10pm UTC](https://discuss.elastic.co/t/ece-setup-failed-to-detect-that-a-master-was-elected/280041 "2021-07-30T14:10:47Z")
Hi Elastic Team, We have setup ECE, trying to move default clusters to Allocators. We are getting following error while moving the cluster from primary node. Plan change failed: \[ClusterFailure:MasterNotDetectedInTime… --- ## [Grok fails to write events on a file](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 2:04pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081 "2021-07-30T14:04:46Z")
I have the following test configuration. Basically I want to write the messages in either the fail or the notfail files depending on whether the grok filter would succeed. I've created the files proactively under a folde… --- ## [Logstash filter take everything after](https://discuss.elastic.co/t/logstash-filter-take-everything-after/280061)
**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 9:56am UTC](https://discuss.elastic.co/t/logstash-filter-take-everything-after/280061 "2021-07-30T09:56:21Z")
Hi avrey one, I wanted to filter this type of message: ip ip text I don't know the format of the text and what is inside of it.I only know that there is 2 ip and the text. How i can geto something that I don't know i… --- ## [Centralization Logstash](https://discuss.elastic.co/t/centralization-logstash/279938)
**Author:** [@Ilya\_21bA](https://discuss.elastic.co/u/Ilya_21bA)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 1:10pm UTC](https://discuss.elastic.co/t/centralization-logstash/279938 "2021-07-30T13:10:47Z")
Hi, tell me, is it necessary to install the entire ELK stack on a new virtual machine, if I want to collect logs from several machines, tell me how it can be done, there are instructions. --- ## [Shard allocation on single node causes cluster overload](https://discuss.elastic.co/t/shard-allocation-on-single-node-causes-cluster-overload/279794)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/shard-allocation-on-single-node-causes-cluster-overload/279794 "2021-07-30T13:06:12Z")
Cluster creates index with 5 shards on same node. And it picks the node with least disk space. High performance ETL process writes all the data on to single node instead of to 5 multiple nodes. This causes overloads of … --- ## [Working with List Fields in Kibana](https://discuss.elastic.co/t/working-with-list-fields-in-kibana/279860)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 11:34am UTC](https://discuss.elastic.co/t/working-with-list-fields-in-kibana/279860 "2021-07-30T11:34:13Z")
Hi all, I'm having difficulty in adding list fields in my project. The fields are already defined & cannot be changed. For ex: Groups: QA, audit, domain, company, admin, ip These are values given for a field in a s… --- ## [Concerns with scaling Logstash when using the Aggregate filter](https://discuss.elastic.co/t/concerns-with-scaling-logstash-when-using-the-aggregate-filter/279855)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 11:26am UTC](https://discuss.elastic.co/t/concerns-with-scaling-logstash-when-using-the-aggregate-filter/279855 "2021-07-30T11:26:55Z")
The aggregate filter is working great in my testing, but I'm concerned about scale because it is stateful and requires setting filter workers to 1 (-w 1 flag). We have about 150 servers, each of which will generate ~2GB … --- ## [Continuously merging documents from multiple indexes](https://discuss.elastic.co/t/continuously-merging-documents-from-multiple-indexes/279953)
**Author:** [@roll](https://discuss.elastic.co/u/roll)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 10:50am UTC](https://discuss.elastic.co/t/continuously-merging-documents-from-multiple-indexes/279953 "2021-07-30T10:50:38Z")
Hi all, I'm fairly new to elasticsearch and have a question regarding merging of documents and removing duplicates. I got the following data structure: topic1: { "\_id": “a12345", "userId" : "x123”, … --- ## [Search\_phase\_execution\_exception (500)](https://discuss.elastic.co/t/search-phase-execution-exception-500/279718)
**Author:** [@fntkg](https://discuss.elastic.co/u/fntkg)\ **Replies:** 0\ **Last updated:** [July 27, 2021, 11:17am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-500/279718 "2021-07-27T11:17:11Z")
When opening apm app in Kibana, i get an error all the time: search\_phase\_execution\_exception (500) and kibana logs (debug mode) doesn't give me any useful info. Can someone give me a hand? :slight\_smile: This is my … --- ## [Kibana monitoring with Metricbeat](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/279728)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 10:16am UTC](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/279728 "2021-07-30T10:16:55Z")
I am trying to monitor kibana with Metricbeat kibana-xpack. But i am getting below log messages. Jul 27 05:47:09 xxxxxxxxx metricbeat\[149229\]: 2021-07-27T05:47:09.110-0700#011ERROR#011\[kibana.stats\]#011stats/stats.go:79… --- ## [Limit ElasticSearch repetitive logs after exception](https://discuss.elastic.co/t/limit-elasticsearch-repetitive-logs-after-exception/279695)
**Author:** [@Stefan\_Speranta](https://discuss.elastic.co/u/Stefan_Speranta)\ **Replies:** 0\ **Last updated:** [July 27, 2021, 7:28am UTC](https://discuss.elastic.co/t/limit-elasticsearch-repetitive-logs-after-exception/279695 "2021-07-27T07:28:50Z")
Hi, We have developed a project using Elastic, Logstash and Kibana as log management. After some site attacks one area of application got into endless loops of exceptions and filled Elastic with the same log massage ag… --- ## [How to pass parameter filter from dashboard to Visualize Kibana](https://discuss.elastic.co/t/how-to-pass-parameter-filter-from-dashboard-to-visualize-kibana/279948)
**Author:** [@HuongCV](https://discuss.elastic.co/u/HuongCV)\ **Replies:** 4\ **Last updated:** [July 30, 2021, 9:46am UTC](https://discuss.elastic.co/t/how-to-pass-parameter-filter-from-dashboard-to-visualize-kibana/279948 "2021-07-30T09:46:51Z")
Hi all, In Dashboard, I have range filter: confirmation\_year from A year to B year. In Elastic have field dead\_year. In metric Visualize , I want to count documents that satisfy the condition: 'dead\_year' less than or… --- ## [How to get all buckets of last 24hrs in date histogram](https://discuss.elastic.co/t/how-to-get-all-buckets-of-last-24hrs-in-date-histogram/279616)
**Author:** [@prathamesh7](https://discuss.elastic.co/u/prathamesh7)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 9:45am UTC](https://discuss.elastic.co/t/how-to-get-all-buckets-of-last-24hrs-in-date-histogram/279616 "2021-07-30T09:45:42Z")
Hi All, I am using Date Histogram with Minimum interval as Hourly to get the results of Last 24 Hours and getting below graph. (v is 7.4) The request is , GET access\*/\_search?pretty=true { "aggs": { "2": { … --- ## [Logstash. Mutate's split doesn't split string](https://discuss.elastic.co/t/logstash-mutates-split-doesnt-split-string/280035)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 9:28am UTC](https://discuss.elastic.co/t/logstash-mutates-split-doesnt-split-string/280035 "2021-07-30T09:28:14Z")
Hi, community. I have field "temp" with this value: "2.4.3-371989". I want split it by dots. With this purpose I use mutate filter this way: mutate { split =\> \["temp", "."\] } But after split "temp" field still equals… --- ## [Logstash stopped due to an error in one of the pipeline configurations](https://discuss.elastic.co/t/logstash-stopped-due-to-an-error-in-one-of-the-pipeline-configurations/279574)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-stopped-due-to-an-error-in-one-of-the-pipeline-configurations/279574 "2021-07-30T07:25:20Z")
We have 10 conf files running in pipeline. The problem is, if any one of the pipeline configurations has some errors then the entire Logstash instance stops though the other pipeline configurations has no errors. How do … --- ## [API Authorization](https://discuss.elastic.co/t/api-authorization/280033)
**Author:** [@shashikant.deshmukh](https://discuss.elastic.co/u/shashikant.deshmukh)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 6:14am UTC](https://discuss.elastic.co/t/api-authorization/280033 "2021-07-30T06:14:18Z")
Dear Expert, I am new to ELK. I need your help to achieve below Request API 1 =\> https://\*\*\*\*\*\*\*\*\*\*\*/api/Account/Authenticate Parameter to pass { "tenancyName": "", "usernameOrEmailAddress": "", "password": "\*\*\*\*… --- ## [How to calculate the elapsed time of a flag status per day?](https://discuss.elastic.co/t/how-to-calculate-the-elapsed-time-of-a-flag-status-per-day/279494)
**Author:** [@MaximeG](https://discuss.elastic.co/u/MaximeG)\ **Replies:** 11\ **Last updated:** [July 30, 2021, 6:35am UTC](https://discuss.elastic.co/t/how-to-calculate-the-elapsed-time-of-a-flag-status-per-day/279494 "2021-07-30T06:35:11Z")
I'd like to figure out the elapsed time between flag status changes. Simplified example : a person can only be sad or happy. I'd like to know how long each mood was active until it changed. I'm looking for a general be… --- ## [How do I set the mandatory insertion of all fields when creating a document](https://discuss.elastic.co/t/how-do-i-set-the-mandatory-insertion-of-all-fields-when-creating-a-document/279849)
**Author:** [@myly-zyr](https://discuss.elastic.co/u/myly-zyr)\ **Replies:** 10\ **Last updated:** [July 30, 2021, 6:00am UTC](https://discuss.elastic.co/t/how-do-i-set-the-mandatory-insertion-of-all-fields-when-creating-a-document/279849 "2021-07-30T06:00:30Z")
In our project, a program does not insert all fields when creating a document, and other programs will report errors when reading the document. I want to set elasticsearch to insert all fields when creating a document. H… --- ## [Search field tags](https://discuss.elastic.co/t/search-field-tags/279932)
**Author:** [@reka.gay](https://discuss.elastic.co/u/reka.gay)\ **Replies:** 2\ **Last updated:** [July 30, 2021, 4:43am UTC](https://discuss.elastic.co/t/search-field-tags/279932 "2021-07-30T04:43:18Z")
My documents have a concept field which has values that act like tags. I would all concepts to be treated individually so I can use them as filters. Imagine e.g. A genre field on a movie database. With the limitation of… --- ## [Timestamp changes in logstash input?](https://discuss.elastic.co/t/timestamp-changes-in-logstash-input/280027)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 4:28am UTC](https://discuss.elastic.co/t/timestamp-changes-in-logstash-input/280027 "2021-07-30T04:28:37Z")
Hello all, I have had this index going for like at least the last 2 years.. and all of a sudden the timezone seems to not be working correctly. The pipeline has some transforms in it, but nothing touches the @timestamp … --- ## [Access Kibana from remote machine](https://discuss.elastic.co/t/access-kibana-from-remote-machine/279924)
**Author:** [@Rickenson\_Robert](https://discuss.elastic.co/u/Rickenson_Robert)\ **Replies:** 10\ **Last updated:** [July 30, 2021, 12:54am UTC](https://discuss.elastic.co/t/access-kibana-from-remote-machine/279924 "2021-07-30T00:54:27Z")
Hi all, I have Kibana running on one machine and I would like to access that instance of Kibana on another machine. That is to say, I want to host Kibana on on my local computer and access it through the web browser of … --- ## [Circuit Breaker Exception - version 5.2.0](https://discuss.elastic.co/t/circuit-breaker-exception-version-5-2-0/279799)
**Author:** [@chateesh](https://discuss.elastic.co/u/chateesh)\ **Replies:** 5\ **Last updated:** [July 30, 2021, 12:26am UTC](https://discuss.elastic.co/t/circuit-breaker-exception-version-5-2-0/279799 "2021-07-30T00:26:18Z")
Hi, Client node is unresponsive and getting error as below "org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[\\] would be larger than limit of \[24003005644/22.3g… --- ## [Observability Engineer Lab 4.4: Enrich policy](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536)
**Author:** [@StashLogs](https://discuss.elastic.co/u/StashLogs)\ **Replies:** 5\ **Last updated:** [July 29, 2021, 9:38pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536 "2021-07-29T21:38:51Z")
Hi, I was following the lab to enrich the geo city/zip code using the enrich policy creation steps. The city name that showed up for me showed the wrong zip code as the address index contains many states with the same c… --- ## [Http Broken Pipe](https://discuss.elastic.co/t/http-broken-pipe/280003)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 4:12pm UTC](https://discuss.elastic.co/t/http-broken-pipe/280003 "2021-07-29T16:12:36Z")
Hello, I'm new to Elasticstack. I am using HTTP output plugin but am getting the following error: \[\[main\]\>worker2\] http - \[HTTP Output Failure\] Could not fetch URL {:url=\>"https://{{fqdn}}:5059", :method=\>:post, :messa… --- ## [Drop messages that end with specific substring](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994)
**Author:** [@bgingras](https://discuss.elastic.co/u/bgingras)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 5:55pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994 "2021-07-29T17:55:35Z")
Hello everyone, I'm trying to implement a Logstash filter that drops syslogs messages that end with a specific substring, something like this: filter { if \[message\].endsWith("substring") { drop { } } } Ha… --- ## [Logstash file input - output to different indices](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-file-input-output-to-different-indices/279906 "2021-07-29T16:02:46Z")
Hello All, I am running ELK 7.6.2 stack. In my current set up, a single file gets ingested in logstash and creates an index successfully as below (only relevant part shown): input { file { path =\> "/opt/gtal/ita… --- ## [Dynamically show or hide visualisation using control](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883)
**Author:** [@antongb](https://discuss.elastic.co/u/antongb)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:37pm UTC](https://discuss.elastic.co/t/dynamically-show-or-hide-visualisation-using-control/278883 "2021-07-29T15:37:48Z")
Hi, I'm using a pie chart to display the % of counts of items from different categories. However, I don't want to display the chart until a category is first chosen from an options control. E.g. there are 2 categories:… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=868) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=870)